Application identification

ABSTRACT

This disclosure describes techniques for identifying an application (e.g., accessing application) that is attempting to access a resource. In some examples, access may be managed by an authentication service. When an access request is received at the authentication service from an application on a client device, the authentication service may ask the application to communicate with an identification agent on the client device. The identification agent may perform one or more tests to discover the identity of the application. In some cases, the identification agent may send the identity of the application to the authentication service. The authentication service may then allow or deny access by the accessing application to the resource based at least in part on the discovered identity.

RELATED APPLICATIONS

This application is a divisional of and claims priority to U.S. patentapplication Ser. No. 17/194,000, filed Mar. 5, 2021.

TECHNICAL FIELD

The present disclosure relates generally to identifying an applicationthat is attempting to access a resource and/or service over a network,thereby improving performance and/or security of the network.

BACKGROUND

A user of a client device may wish to gain access to a resource and/orservice (e.g., website) via a network. A decision to grant or denyaccess to the client device may be based on a policy. In some examples,the policy may be based at least in part on the identity of anapplication that is being used by the client device to access thenetwork. However, if the application is not correctly identified, accessmay be granted inappropriately, or access may be denied inappropriately.In some examples, identification of the accessing application may bedifficult. For example, a user agent on the client device mayincorrectly report an identity of the accessing application, or mayincorrectly report other information related to the application orrelated to the client device. Incorrect reporting of information aboutthe application or client device may be accidental or may be purposeful,even nefarious. Regardless, improved methods for correctly identifyingan accessing application may help make more informed decisions aboutwhether to grant access to a resource.

BRIEF DESCRIPTION OF THE DRAWINGS

The detailed description is set forth below with reference to theaccompanying figures. In the figures, the left-most digit(s) of areference number identifies the figure in which the reference numberfirst appears. The use of the same reference numbers in differentfigures indicates similar or identical items. In some cases,parentheticals are utilized after a reference number to distinguish likeelements. Use of the reference number without the associatedparenthetical is generic to the element. The systems depicted in theaccompanying figures are not to scale and components within the figuresmay be depicted not to scale with each other.

FIG. 1 illustrates a component diagram with an example environment inwhich application identification may be employed among devices, inaccordance with the present concepts.

FIGS. 2 and 3 illustrate example diagrams of communications that devicesof FIG. 1 may exchange in order to perform application identificationtechniques, in accordance with the present concepts.

FIGS. 4 and 5 illustrate flow diagrams of example methods forapplication identification among devices, in accordance with the presentconcepts.

FIG. 6 illustrates a computing system diagram illustrating aconfiguration for a data center that can be utilized to implementaspects of the technologies disclosed herein.

FIG. 7 is a computer architecture diagram showing an illustrativecomputer hardware architecture for implementing a device that can beutilized to implement aspects of the various technologies presentedherein.

DESCRIPTION OF EXAMPLE EMBODIMENTS Overview

This disclosure describes, at least in part, a method that may beimplemented by a client device communicatively coupled to networkresources. The method may include receiving an identity request for anidentity of an application on a client device. The identity request maybe received from the application at a first port of the client deviceand received by an identification agent at a second port of the clientdevice. The method may include accessing a port list that includesinformation regarding entities using the first port and the second portof the client device. Based at least in part on the information from theport list, the method may include determining, by the identificationagent, the application that is utilizing the first port to communicatethe request. The method may include sending, by the identificationagent, a query for the identity of the application that is utilizing thefirst port. The method may also include receiving, in response to thequery, the identity of the application. Finally, the method may includesending the identity of the application to an authentication service ona remote device.

This disclosure also describes, at least in part, a method that may beimplemented by network resources communicatively coupled to a clientdevice. The method may include receiving, at an authentication serviceand from an application on a remote client device, an access request toaccess a resource managed by the authentication service. The accessrequest may be received via a first communication channel between theauthentication service and the remote client device. In response to theaccess request, the method may include sending a directive to theapplication. The directive may direct the application to send anidentity request for an identity of the application to an identificationagent on the remote client device. The method may include receiving, atthe authentication service and from the identification agent, theidentity of the application, wherein the identity is received via asecond communication channel between the authentication service and theremote client device. Based at least in part on the identity of theapplication, the method may include making, by the authenticationservice, an access determination regarding whether to allow theapplication to access to the resource. Further, the method may includesending, to the application at the remote client device, a response tothe access request, the response based at least in part on the accessdetermination.

Additionally, the techniques described herein may be performed by asystem and/or device having non-transitory computer-readable mediastoring computer-executable instructions that, when executed by one ormore processors, performs the method described above.

EXAMPLE EMBODIMENTS

This disclosure describes techniques for identifying an application(e.g., accessing application) that is attempting to access a resourceand/or service, such as a website. In some examples, access may bemanaged by an authentication service. When an access request is receivedat the authentication service from an application on a client device,the authentication service may ask the application to communicate withan identification agent on the client device. The identification agentmay perform one or more tests regarding the accessing application and/orthe client device. Through the one or more tests, the identificationagent may discover the identity of the accessing application. In somecases, the identification agent may send the discovered identity to theauthentication service. The authentication service may then allow ordeny access by the accessing application to the resource based at leastin part on the discovered identity.

In some examples, a user may wish to log in to a resource that isavailable over a network. As used herein, “resource” may represent awide variety of services or entities that may require authenticationand/or authorization to access. For example, a resource may be a websiteor cloud service with which the user has a user account. The useraccount may have associated login and/or password information with whichthe user may authenticate in order to gain access to the user account.For security or management purposes, the resource may establish arelationship with an authentication service purpose to help authenticateand/or authorize users attempting to access the resource. In some cases,an authentication service may be a multiple factor authenticationservice (e.g., a dual-authentication service). For example, the user mayprovide the login and/or password information for the user account, andthe authentication service may provide an additional level ofauthentication and/or authorization before determining that a usershould be allowed or denied access to the resource. The additionalauthentication/authorization may include investigating an identity ofthe application with which the user is attempting to gain access to theresource. Additionally, the authentication service may learn otherinformation about a client device with which the user is attemptingaccess, collect further information from the user (e.g., biometrics),etc.

For illustration purposes, consider that a user with a client deviceintends to login to a resource at a remote device. The user utilizes anapplication on the client device to initiate the login request. The usermay enter login and/or password information to attempt to login to auser account. The “application” may be any of a variety of applicationsthat can be used to access a resource. An application could includevarious types of web browsers, embedded browsers, and/or nativeapplications on the user device. For example, an application may includea browser running “under the hood,” of the application. As such, theidentity or nature of the particular software that is attempting toaccess the resource may be relatively obscure and/or complicated. Theapplication may not be required to report an identity of theapplication, or may report some other aspect of the application whilethe identity of the particular portion that is requesting access remainsobscure. Previously, when web browser was being used as anauthentication application, the only way to enforce policy around thatapplication was to use the user-agent HTTP header that the embeddedbrowser provided. The techniques described herein makes use of aseparate process to map the access request to an identifier thatdivulges a true identity of the application, outside of what is reportedby the user-agent. The example applications described herein are notmeant to be limiting.

When the user attempts to login to the resource, the request may be sentto the authentication service at some point in the login process. Therequest may or may not be routed to or through a device associated withthe resource before arriving at the authentication service. Regardless,once the request (or notice of the request) arrives at theauthentication service, a communication channel is established betweenthe client device of the user and the authentication service. Theauthentication service may be located at a particular device (e.g.,server) or may potentially be represented by multiple devices. Forinstance, the authentication service may be cloud-based, providingauthentication (and/or authorization, etc.) services through multiplenetworked cloud computing resources.

In order to make an informed decision regarding allowing or denyingaccess by the client device to the resource, the authentication servicemay send instructions to the application on the client device tocommunicate with an identification agent. The identification agent maybe software and/or code located on the client device. The identificationagent may be a partner and/or extension of the authentication service.In response to the request, the application may communicate with theidentification agent. The identification agent may perform one or moretests to assist the authentication service with identification of theaccessing application and/or collecting or discovering other informationthat may help the authentication service to determine whether to allowor deny access to the resource. The tests may include a variety ofqueries or other methods of acquiring information about the accessingapplication and/or the client device in general. For example, oncecommunication between the application and the identification agent isestablished, the identification agent may learn a port (e.g., port ID,port number) through which the application is communicating. Theidentification agent may use the port ID to look up an identity of theapplication that is running on that port ID. In this manner, theidentification agent may learn the identity of the application withoutrelying on the application to truthfully divulge the identity to eitherthe identification agent or the authentication service. Therefore, theidentification agent may be more resistant to spoofing by an applicationthan other methods that rely on information presented or offered by theapplication (e.g., presented by a user agent).

Once the identification agent has discovered the identity of theapplication, the identification agent may report the identity and/orother information about the application (e.g., version) and/or about theclient device (e.g., operating system) to the authentication service.The identification agent may open a separate channel to communicate withthe authentication service. The authentication service may then be ableto make a better-informed decision about whether to allow or deny accessto the resource. For instance, the authentication service may apply apolicy in the decision-making process. The policy may stipulate thatcertain applications may be used to access the resource, while othersshould be prevented from being used to access the resource. Since theidentity of the application was learned by the identification agentwithout relying on the application to truthfully divulge the identity,and the identification agent communicated the identity to theauthentication service separately (not through the application), theauthentication service may be able to more successfully apply thepolicy. Therefore, security for the resource is improved, through anidentification process that is more robust to tricking or fooling, orsimply being presented with incorrect information.

To summarize, a more robust technique for identifying an applicationthat requests access to a resource may improve network security and/oroperations. The techniques described herein include using anidentification agent located on a client device that is able to discoverthe identity of an application, without relying on the application totruthfully divulge its identity. The identification agent may be enactedwith relatively low overhead and/or low draw on computing resources. Insome examples, the identification agent may be viewed as a lightweightmechanism for improving security, featuring both relatively lowcomputational cost and relatively low bandwidth usage. Furthermore,improved decisions regarding allowing or denying access to a resourcemay help reduce the future cost(s) of inappropriately allowing ordenying access, such as the cost to retroactively deny access or resolveaccess for entities that should have been allowed into the resource.

Although the examples described herein may refer to an identificationagent on a client device as the central point of applicationidentification, the techniques can generally be applied to any device ina network. Further, the techniques are generally applicable for anynetwork of devices managed by any entity where virtual resources areprovisioned. In some instances, the techniques may be performed bysoftware-defined networking (SDN), and in other examples, variousdevices may be used in a system to perform the techniques describedherein. The devices by which the techniques are performed herein are amatter of implementation, and the techniques described are not limitedto any specific architecture or implementation.

The techniques described herein provide various improvements andefficiencies with respect to network communications. For instance, thetechniques described herein may reduce the amount of computationalresource use, storage, dropped data, latency, and other issuesexperienced in networks due to lack of network resources, overuse ofnetwork resources, issues with timing of network communications, and/orimproper routing of data. By improving network communications across anetwork, overall performance by servers and virtual resources may beimproved.

Certain implementations and embodiments of the disclosure will now bedescribed more fully below with reference to the accompanying figures,in which various aspects are shown. However, the various aspects may beimplemented in many different forms and should not be construed aslimited to the implementations set forth herein. The disclosureencompasses variations of the embodiments, as described herein. Likenumbers refer to like elements throughout.

FIG. 1 illustrates an example environment 100 in accordance with thepresent application identification concepts. Example environment 100 mayinclude network resources 102 (e.g., cloud-based resources), a serverdevice 104, and/or client devices 106 (e.g., user devices). Networkresources 102 may include any of a variety of computing resources suchas server devices, applications, databases, storage devices, networks,other computing devices, etc. These computing resources may be viewed asbeing remote from a client device 106 and/or a server device 104, andtherefore may be referred to simply as one or more remote devices. InFIG. 1 , three client devices 106 are depicted, including client device106(1), client device 106(2), and client device 106(3). Herein,parentheticals are utilized after a reference number to distinguish likeelements. Use of the reference number without the associatedparenthetical is generic to the element. As such, a client device 106may represent any of a variety of computing devices of a user, such as acomputer, laptop, mobile device, tablet, smart watch, etc.

In example environment 100, network resources 102, server device 104,client devices 106, and/or other devices may be communicatively coupledto each other via network 108 (e.g., cloud computing network). Withinthe example environment 100, server device 102, network resources 104,client devices 106, and/or other devices may exchange communications(e.g., packets) via a network connection(s) to network 108, indicated bydouble arrows 110. For instance, network connections 110 may betransport control protocol (TCP) network connections or any networkconnection (e.g., information-centric networking (ICN)) that enables theserver device 102 to exchange packets with other devices via network108. The network connections 110 represent, for example, data pathsbetween the server device 102, network resources 104, and client devices106. It should be appreciated that the term “network connection” mayalso be referred to as a “network path.” Also, the data may pass throughone or more other network devices (e.g., router, switch) on any pathbetween the server device 102, network resources 104, and/or clientdevices 106. The suggestion of a cloud computing network(s) relative tothe example environment in FIG. 1 is not meant to be limiting. Othertypes of networks are contemplated in accordance with applicationidentification concepts.

In some examples, any of client devices 106 may try to access a resource112 (e.g., website) at server device 104. For example, a user of clientdevice 106(1) may wish to log on to a website at server device 104.Server device 104 may host and/or control access to the website and/orother resource. The client device 106(1) may use an application 114(1)to attempt access to the resource 112 at server device 104. In somecases, the resource 112 may use an authentication service 116 located atnetwork resources 102 to help determine whether to allow or deny accessby the application 114(1). Further, the authentication service 116 mayutilize an identification (ID) agent 118(1) on client device 106(1) tohelp discover information about the application 114(1) and/or the clientdevice 106(1). The authentication service 116 may then be able to useany discovered information, such as an identity of application 114(1),to make a decision regarding allowing or denying access to the resource112. For instance, the authentication service 116 may apply a policy(e.g., software-based policy) to the identity of application 114(1) togrant or deny access.

FIG. 1 illustrates example communications between network resources 102,authentication service 116, client device 106(1), application 114(1),and/or identification agent 118(1) in accordance with the presentapplication identification concepts. The communications are indicatedwith dashed, numbered lines. For example, the communication(s) at “Step1” may include client device 106(1) using application 114(1) tocommunicate with network resources 102 regarding accessing resource 112.Step 1 may also represent authentication service 116 (and/or networkresources 102) communicating with application 114(1) to establishcommunication with identification agent 118(1). As a result, at “Step2,” application 114(1) may communicate with identification agent 118(1).Also at Step 2, identification agent 118(1) may collect informationand/or perform tests to help discover information about application114(1). Identification agent may or may not communicate with otherentities or components of client device 106(1) to collect informationregarding application 114(1) or client device 106(1). In some examples,when identification agent 118(1) discovers an identity of application114(1) and/or other information about application 114(1) and/or clientdevice 106(1), at “Step 3” identification agent 118(1) may communicateany of the information to authentication service 116. Additional detailregarding potential communications between authentication service 116,an identification agent 118, and/or an application 114 will be providedrelative to the examples illustrated in FIGS. 2 and 3 , below.

FIG. 2 illustrates an example diagram 200 of communications thatentities described relative to FIG. 1 may exchange to performapplication identification techniques. For example, diagram 200 mayrepresent a call flow between at least some of the devices and/orapplications of FIG. 1 . FIG. 2 includes authentication service 116 (atnetwork resources 102), an identification agent 118 (at client device106), and an application 114 (also at client device 106).

At 202 of FIG. 2 , authentication service 116 may receive an accessrequest from application 114. As suggested above, the access request maycome more or less directly from client device 106 to authenticationservice 116, may be forwarded from another entity (such as the serverdevice 104 that offers the resource 112 (FIG. 1 )), or authenticationservice 116 may receive some other indication that application 114 onclient device 106 wishes to access the resource 112 at server device104.

At 204 of FIG. 2 , authentication service 116 may communicate withapplication 114. The communication may represent an open channel orother connection between authentication service 116 and application 114.The communication may include a request and/or other directive forapplication 114 to communicate with identification agent 118. Forexample, authentication service 116 may offer a hypertext markuplanguage (HTML) document to application 114. The HTML document mayinclude code that directs application 114 to communicate withidentification agent 118, which is also located on client device 106.For instance, the code may direct application 114 to send a hypertexttransfer protocol (HTTP) request, an Asynchronous JavaScript And XML(Ajax) request, or some other communication (e.g., WebSocket) toidentification agent 118.

At 206 of FIG. 2 , application 114 may communicate with identificationagent 118. In this example, application 114 sends an Ajax request toidentification agent 118. Application 114 may communicate withidentification agent 118 via a first open port within client device 106.Identification agent 118 may receive the communication via a second openport of client device 106.

At 208 of FIG. 2 , identification agent 118 may continue to communicatewith application 114 (and/or with other elements of client device 106)as part of a collection phase of the application identification process,to collect and/or check information about application 114 and/or otherelements of client device 106. The collection phase may represent one ormore tests, queries, and/or responses. Identification agent 118 may useapplication program interfaces (APIs) to make one or more tests orqueries, for instance. In some examples, identification agent 118 may beable to access a list (e.g., port list, table, database) of open ports(e.g., ports in use, active ports) of client device 106, or otherwisefind out which ports of client device 106 are being used forcommunication, and/or which ports are communicating with each other. Forinstance, identification agent 118 may query an IPv4 TCP connectiontable using a loopback IP address as both the remote and local address.Identification agent 118 may further narrow down the results byconsidering the source and destination ports (first and second ports).In a case where the narrowed results match the result from the IPv4 TCPconnection table, the application 114 using the source port (first port)has been located. Identification agent 118 may then make a system callto retrieve a process identification (PID) of the application 114.Identification agent 118 may use the PID to send a query requesting thename of application 114 using the PID, leaving identification agent 118with the true identity of application 114 that made the access request.In other examples of the collection phase of the applicationidentification process, identification agent 118 may further learn theversion of application 114, an operating system of client device 106,whether client device 106 employs a firewall, etc. The information maybe related to network and/or device security, general health, operatingperformance, and/or various other aspects of application 114 and/orclient device 106.

In some cases, aspects and/or an order of a call flow may be based atleast in part on an operating system of client device 106. For purposesof illustration, the description of the collection phase of step 208provided above may correspond to an example where the operating systemof client device 106 is Windows (Microsoft). For comparison, thedescription of step 208 provided below may correspond to an examplewhere the operating system of client device 106 is macOS (Apple Inc.) orLinux.

At 208 of FIG. 2 , in another example, identification agent 118 mayretrieve the PID by an alternative method. In this example,identification agent 118 may also make use of system calls to retrievethe PID. However, identification agent 118 may get a list of all runningprocesses by PID. Identification agent 118 may filter out thoseprocesses without a PID at all (i.e., the PID is 0 in the query result).Identification agent 118 may further filter down the list by finding aprocess that has an open communication with a port of the identificationagent 118 showing as both the source and destination port, so that thelogic arrives at the PID of application 114. In a case where theapplication 114 in question is still ambiguous, identification agent 118may use additional operating system APIs in order to inspect a parentprocess of application 114. Additional operating system APIs may allowidentification of ambiguous cases. For instance, Apple Safari mayinitially look identical to other applications using embedded WebKitviews, until an additional inspection is performed.

At 210 of FIG. 2 , identification agent 118 may communicate withauthentication service 116. For example, identification agent 118 maysend an HTTP request and/or use a HTTPS connection to talk toauthentication service 116. The communication between identificationagent 118 and authentication service 116 may represent a second openchannel or other connection. In other words, the communication betweenidentification agent 118 and authentication service 116 may represent asecond communication channel between client device 106 and networkresources 102 that is separate from the first communication channelbetween authentication service 116 and application 114. As such,authentication service 116 can trust the information it receives fromidentification agent 118, since the information is not routed through apotentially untrusted entity (e.g., application 114). Authenticationservice 116 knows to associate the communication from the identificationagent 118 with the access request received from application 114.Identification agent 118 may send information to the authenticationservice 116, such as the identity of application 114 and/or otherinformation about application 114 and/or client device 106.Authentication service 116 is therefore enabled to make abetter-informed decision regarding allowing or denying the accessrequest from application 114. Authentication service 116 may also savethe identity or other information. In some examples, authenticationservice 116 may overwrite previously received identity information, suchas an identity reported by a user-agent, since the identity receivedfrom identification agent 118 is expected to be more accurate.

FIG. 3 illustrates an additional example diagram 300 of communicationsthat devices of FIG. 1 may exchange to perform applicationidentification techniques. Some aspects of the example communicationsshown in FIG. 3 may be similar to aspects of the example communicationsdescribed above relative to FIG. 2 . Therefore, for sake of brevity, notall elements of FIG. 3 will be described in detail. For example, steps302-308 of FIG. 3 may be considered similar to Steps 202-208 of FIG. 2 .

FIG. 3 illustrates an alternative method by which the identity ofapplication 114 and/or other information is returned to authenticationservice 116 from identification agent 118. In FIG. 3 , rather than theidentity result being sent directly from identification agent 118 toauthentication service 116 by a new channel or other connection, theidentity result is passed through application 114. However, to preventapplication 114 from changing the result, for example to hide theidentity, identification agent 118 may sign the message so thatauthentication service 116 knows to trust the identity. At 310identification agent 118 sends the signed identity result to application114. At 312 application 114 forwards the signed identity result toauthentication service 116. Since the message is signed byidentification agent 118, authentication service 116 knows to trust theidentity of application 114 contained in the message. Forwarding theidentity result through application 114 may prevent the need toestablish a separate connection between identification agent 118 andauthentication service 116.

Other variations of application identification techniques arecontemplated. For example, some of the decision-making regardingallowing or denying access to the resource could be enabled inidentification agent 118. Stated another way, identification agent 118could be “smarter,” able to contribute to the decision-making process. Apotential benefit could be determining that further information may needto be collected for a well-informed decision to be made, andidentification agent 118 could initiate collecting additional, targetedinformation. In another example variation, identification agent 118could monitor various applications and/or software used at client device106 over time. When an access request is presented, identification agent118 could determine whether the requesting application is regularly usedat client device 106, or unusual for use at client device 106. A policygoverning allowing or denying access may be written to specify that anunusual application may be considered more suspicious, and may indicatethat the access should be denied.

To summarize, the application identification techniques described hereinmay enable accurate identification of software that is attempting accessa resource. The techniques may be relatively lightweight, featuring lowcomputational cost and/or low bandwidth usage. Even when an HTTPuser-agent reports indistinguishable and/or erroneous values, thepresent techniques utilize operating system APIs to accurately identifythe requesting software. After the identity collection phase, which isswift and not system-resource intensive, the information may be relayedback to authentication service which can then more accurately applyaccess policy before allowing a user to authenticate. More appropriatecontrol of access to resources can help prevent further unduecomputational cost and/or bandwidth usage, improving performance of theentities involved. Therefore, application identification techniques mayimprove security and/or performance of network resources.

FIGS. 4 and 5 illustrate flow diagrams of example methods 400 and 500that include functions that may be performed at least partly by a clientdevice and/or network resources, such as client devices 106 and/ornetwork resources 102 described relative to FIG. 1. The logicaloperations described herein with respect to FIGS. 4 and 5 may beimplemented (1) as a sequence of computer-implemented acts or programmodules running on a computing system and/or (2) as interconnectedmachine logic circuits or circuit modules within the computing system.

The implementation of the various devices and/or components describedherein is a matter of choice dependent on the performance and otherrequirements of the computing system. Accordingly, the logicaloperations described herein are referred to variously as operations,structural devices, acts, or modules. These operations, structuraldevices, acts, and modules may be implemented in software, in firmware,in special purpose digital logic, and any combination thereof. It shouldalso be appreciated that more or fewer operations might be performedthan shown in the FIGS. 4 and 5 and described herein. These operationsmay also be performed in parallel, or in a different order than thosedescribed herein. Some or all of these operations may also be performedby components other than those specifically identified. Although thetechniques described in this disclosure are with reference to specificdevices, in other examples, the techniques may be implemented by lessdevices, more devices, different devices, or any configuration ofdevices and/or components.

FIG. 4 illustrates a flow diagram of an example method 400 for a networkdevice to perform application identification techniques. Method 400 maybe performed by a client device (e.g., client device 106)communicatively coupled to network resources (e.g., network resources102) and/or other devices, for instance. In some examples, method 400may be performed by a computing device comprising one or more processorsand one or more non-transitory computer-readable media storingcomputer-executable instructions that, when executed by the one or moreprocessors, cause the one or more processors to perform method 400.

At 402, method 400 may include receiving an identity request for anidentity of an application on a client device. In some examples, theidentity request may be received from the application at a first port ofthe client device. Also, the identity request may be received by anidentification agent at a second port of the client device. The identityrequest may be received at the application in response to an earlieraction by the application. For example, the application may haveinitiated communication with an authentication service at a remotedevice by sending an access request to the authentication service. Theaccess request may correspond to a resource managed by theauthentication service. For instance, the authentication service maymanage access to the resource for a separate server device that hosts orowns the resource. In some examples, in response to the access request,the authentication service may send a directive to the application,directing the application to send the identity request for the identityof the application to the identification agent on the client device. Theauthentication service may be interested in the identity of theapplication in order to determine whether to grant or deny access to theresource, for instance. The identity request for the identity of theapplication may be an HTTP request, an Ajax request, and/or some otherform of communication request and/or invitation sent from theapplication to the identification agent, in compliance with thedirective from the authentication service, for instance.

At 404, method 400 may include accessing a port list that includesinformation regarding entities that may be using the first port and thesecond port of the client device. In some examples, the port list may bea transport control protocol (TCP) connection table that includesinformation regarding which ports of the client device are in use, areconnected in communication, and/or which entity is using any given port.

At 406, based at least in part on the information from the port list,method 400 may include determining, by the identification agent, theapplication that is utilizing the first port to communicate the request.In some examples, the identification agent may initiate a system call.In response to the system call, the identification agent may receive aprocess identification (PID) of the application. The PID may be used bythe identification agent to gather further information regarding theapplication.

At 408, method 400 may include sending, by the identification agent, aquery for the identity of the application that is utilizing the firstport. In some examples, the query may be based on the PID of theapplication received in response to the system call.

At 410, in response to the query, method 400 may include receiving theidentity of the application. The identity of the application may includea browser identity of a browser. The browser may have been used tocommunicate between the application and the authentication service. Forinstance, the browser may have sent the access request to theauthentication service.

At 412, method 400 may include sending the identity of the applicationto the authentication service, which may be located on a remote device.The identity of the application sent to the authentication service mayinclude the browser identity, a version of the browser, and/or otherinformation regarding the application or the client device, such as anoperating system of the client device, etc.

FIG. 5 illustrates a flow diagram of an example method 500 for networkdevices to perform application identification techniques. Method 400 maybe performed by network resources (e.g., network resources 102)communicatively coupled to a client device (e.g., client device 106)and/or other devices, for instance. In some examples, method 500 may beperformed by a computing device comprising one or more processors andone or more non-transitory computer-readable media storingcomputer-executable instructions that, when executed by the one or moreprocessors, cause the one or more processors to perform method 500.

At 502, method 500 may include receiving, at an authentication serviceoffered via the network resources and from an application on a remoteclient device, an access request. The access request may indicate that auser of the client device wishes to access a resource managed by theauthentication service. In some examples, the access request may bereceived via a first communication channel between the authenticationservice and the remote client device.

At 504, in response to the access request, method 500 may includesending a directive to the application. The directive may direct theapplication to send an identity request for an identity of theapplication to an identification agent on the remote client device.

At 506, method 500 may include receiving, at the authentication serviceand from the identification agent, the identity of the application. Theidentity of the application may include a browser identity of a browserthat is used to communicate between the remote client device and theauthentication service. The identity may include additional informationin some cases, such as a version of the browser. In some examples, theidentity may be received via a second communication channel between theauthentication service and the remote client device.

At 508, based at least in part on the identity of the application,method 500 may include having the authentication service make an accessdetermination regarding whether to allow the application to access tothe resource. In some examples, the access determination may beperformed by applying a policy. For instance, the policy may considerthe identity of the application in determining whether to allow or denyaccess to the resource by the application. Additionally, theauthentication service may store the identity of the application withinthe network resources, which may be useful to the authentication servicefor future reference. In some cases, the authentication service mayoverwrite previously received identity information corresponding to theapplication. For instance, a previously received identity of theapplication may have been received from a user-agent associated with theapplication, and therefore may be less trusted than the identityreceived from the identification agent.

At 510, method 500 may include sending a response to the access requestfrom the authentication service to the application at the remote clientdevice based at least in part on the access determination. For instance,the response may include an indication that access to the resource isallowed or denied. In some examples, the response may include furthercommunication regarding a login process for the client device to accessthe resource. In other examples, the authentication service may send theindication that access to the resource is allowed or denied to a serverdevice that hosts the resource, rather than to the client device.Additionally or alternatively, the authentication service may simplyproceed with facilitating access by the client device to the resource,without sending an indication of the access determination.

FIG. 6 is a computing system diagram illustrating a configuration for adata center 600 that can be utilized to implement aspects of thetechnologies disclosed herein. The example data center 600 shown in FIG.6 includes several computers 602A-602F (which might be referred toherein singularly as “a computer 602” or in the plural as “the computers602”) for providing computing resources. In some examples, the resourcesand/or computers 602 may include, or correspond to, any type ofnetworked device described herein, such as a network resources (102),network 108, and/or server device (104). Although, computers 602 maycomprise any type of networked device, such as servers, switches,routers, hubs, bridges, gateways, modems, repeaters, access points,hosts, etc.

The computers 602 can be standard tower, rack-mount, or blade servercomputers configured appropriately for providing computing resources. Insome examples, the computers 602 may provide computing resources 604including data processing resources such as virtual machine (VM)instances or hardware computing systems, database clusters, computingclusters, storage clusters, data storage resources, database resources,networking resources, and others. Some of the computers 602 can also beconfigured to execute a resource manager 606 capable of instantiatingand/or managing the computing resources. In the case of VM instances,for example, the resource manager 606 can be a hypervisor or anothertype of program configured to enable the execution of multiple VMinstances on a single computer 602. Computers 602 in the data center 600can also be configured to provide network services and other types ofservices.

In the example data center 600 shown in FIG. 6 , an appropriate localarea network (LAN) 608 is also utilized to interconnect the computers602A-602F. It should be appreciated that the configuration and networktopology described herein has been greatly simplified and that many morecomputing systems, software components, networks, and networking devicescan be utilized to interconnect the various computing systems disclosedherein and to provide the functionality described above. Appropriateload balancing devices or other types of network infrastructurecomponents can also be utilized for balancing a load between datacenters 600, between each of the computers 602A-602F in each data center600, and, potentially, between computing resources in each of thecomputers 602. It should be appreciated that the configuration of thedata center 600 described with reference to FIG. 6 is merelyillustrative and that other implementations can be utilized.

In some examples, the computers 602 may each execute one or moreapplication containers and/or virtual machines to perform techniquesdescribed herein. For instance, the containers and/or virtual machinesmay serve as server devices, user devices, and/or routers in network 108and/or network resources 102.

In some instances, the data center 600 may provide computing resources,like application containers, VM instances, and storage, on a permanentor an as-needed basis. Among other types of functionality, the computingresources provided by a cloud computing network may be utilized toimplement the various services and techniques described above. Thecomputing resources 604 provided by the cloud computing network caninclude various types of computing resources, such as data processingresources like application containers and VM instances, data storageresources, networking resources, data communication resources, networkservices, and the like.

Each type of computing resource 604 provided by the cloud computingnetwork can be general-purpose or can be available in a number ofspecific configurations. For example, data processing resources can beavailable as physical computers or VM instances in a number of differentconfigurations. The VM instances can be configured to executeapplications, including web servers, application servers, media servers,database servers, some or all of the network services described above,and/or other types of programs. Data storage resources can include filestorage devices, block storage devices, and the like. The cloudcomputing network can also be configured to provide other types ofcomputing resources 604 not mentioned specifically herein.

The computing resources 604 provided by a cloud computing network may beenabled in one embodiment by one or more data centers 600 (which mightbe referred to herein singularly as “a data center 600” or in the pluralas “the data centers 600”). The data centers 600 are facilities utilizedto house and operate computer systems and associated components. Thedata centers 600 typically include redundant and backup power,communications, cooling, and security systems. The data centers 600 canalso be located in geographically disparate locations. One illustrativeembodiment for a data center 600 that can be utilized to implement thetechnologies disclosed herein will be described below with regard toFIG. 7 .

FIG. 7 shows an example computer architecture 700 for a computer 602capable of executing program components for implementing thefunctionality described above. The computer architecture 700 shown inFIG. 7 illustrates a conventional server computer, workstation, desktopcomputer, laptop, tablet, network appliance, e-reader, smartphone,and/or other computing device, and can be utilized to execute any of thesoftware components presented herein. The computer 602 may, in someexamples, correspond to a physical device described herein (e.g., serverdevice, user device, router, etc.), and may comprise networked devicessuch as servers, switches, routers, hubs, bridges, gateways, modems,repeaters, access points, etc. For instance, computer 602 may correspondto client device 106, network resources 102, and/or server device 104.

As shown in FIG. 7 , the computer 602 includes a baseboard 702, or“motherboard,” which is a printed circuit board to which a multitude ofcomponents or devices can be connected by way of a system bus or otherelectrical communication paths. In one illustrative configuration, oneor more central processing units (“CPUs”) 704 operate in conjunctionwith a chipset 706. The CPUs 704 can be standard programmable processorsthat perform arithmetic and logical operations necessary for theoperation of the computer 602.

The CPUs 704 perform operations by transitioning from one discrete,physical state to the next through the manipulation of switchingelements that differentiate between and change these states. Switchingelements generally include electronic circuits that maintain one of twobinary states, such as flip-flops, and electronic circuits that providean output state based on the logical combination of the states of one ormore other switching elements, such as logic gates. These basicswitching elements can be combined to create more complex logiccircuits, including registers, adders-subtractors, arithmetic logicunits, floating-point units, and the like.

The chipset 706 provides an interface between the CPUs 704 and theremainder of the components and devices on the baseboard 702. Thechipset 706 can provide an interface to a RAM 708, used as the mainmemory in the computer 602. The chipset 706 can further provide aninterface to a computer-readable storage medium such as a read-onlymemory (“ROM”) 710 or non-volatile RAM (“NVRAM”) for storing basicroutines that help to startup the computer 602 and to transferinformation between the various components and devices. The ROM 710 orNVRAM can also store other software components necessary for theoperation of the computer 602 in accordance with the configurationsdescribed herein.

The computer 602 can operate in a networked environment using logicalconnections to remote computing devices and computer systems through anetwork, such as the network 108 and/or 608. The chipset 706 can includefunctionality for providing network connectivity through a networkinterface controller (NIC) 712, such as a gigabit Ethernet adapter. TheNIC 712 is capable of connecting the computer 602 to other computingdevices over the network 108. For instance, in the example shown in FIG.7 , NIC 712 may help facilitate transfer of data, packets, and/orcommunications over the network 108 between client device 106 andnetwork resources 102. It should be appreciated that multiple NICs 712can be present in the computer 602, connecting the computer to othertypes of networks and remote computer systems.

The computer 602 can be connected to a storage device 714 that providesnon-volatile storage for the computer. The storage device 714 can storean operating system 716, programs 718, and/or other data, such as a portlist, TCP connection table, application identity information, etc. Thestorage device 714 can be connected to the computer 602 through astorage controller 722 connected to the chipset 706, for example. Thestorage device 714 can consist of one or more physical storage units.The storage controller 722 can interface with the physical storage unitsthrough a serial attached SCSI (“SAS”) interface, a serial advancedtechnology attachment (“SATA”) interface, a fiber channel (“FC”)interface, or other type of interface for physically connecting andtransferring data between computers and physical storage units.

The computer 602 can store data on the storage device 714 bytransforming the physical state of the physical storage units to reflectthe information being stored. The specific transformation of physicalstate can depend on various factors, in different embodiments of thisdescription. Examples of such factors can include, but are not limitedto, the technology used to implement the physical storage units, whetherthe storage device 714 is characterized as primary or secondary storage,and the like.

For example, the computer 602 can store information to the storagedevice 714 by issuing instructions through the storage controller 722 toalter the magnetic characteristics of a particular location within amagnetic disk drive unit, the reflective or refractive characteristicsof a particular location in an optical storage unit, or the electricalcharacteristics of a particular capacitor, transistor, or other discretecomponent in a solid-state storage unit. Other transformations ofphysical media are possible without departing from the scope and spiritof the present description, with the foregoing examples provided only tofacilitate this description. The computer 602 can further readinformation from the storage device 714 by detecting the physical statesor characteristics of one or more particular locations within thephysical storage units.

In addition to the mass storage device 714 described above, the computer602 can have access to other computer-readable storage media to storeand retrieve information, such as policies, program modules, datastructures, and/or other data. It should be appreciated by those skilledin the art that computer-readable storage media is any available mediathat provides for the non-transitory storage of data and that can beaccessed by the computer 602. In some examples, the operations performedby the network 108, and or any components included therein, may besupported by one or more devices similar to computer 602. Statedotherwise, some or all of the operations performed by the network 108,and or any components included therein, may be performed by one or morecomputer devices 602 operating in a cloud-based arrangement.

By way of example, and not limitation, computer-readable storage mediacan include volatile and non-volatile, removable and non-removable mediaimplemented in any method or technology. Computer-readable storage mediaincludes, but is not limited to, RAM, ROM, erasable programmable ROM(“EPROM”), electrically-erasable programmable ROM (“EEPROM”), flashmemory or other solid-state memory technology, compact disc ROM(“CD-ROM”), digital versatile disk (“DVD”), high definition DVD(“HD-DVD”), BLU-RAY, ternary content addressable memory (TCAM), and/orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium that canbe used to store the desired information in a non-transitory fashion.

As mentioned briefly above, the storage device 714 can store anoperating system 716 utilized to control the operation of the computer602. According to one embodiment, the operating system comprises theLINUX operating system. According to another embodiment, the operatingsystem comprises the WINDOWS® SERVER operating system from MICROSOFTCorporation of Redmond, Washington. According to further embodiments,the operating system can comprise the UNIX operating system or one ofits variants. It should be appreciated that other operating systems canalso be utilized. The storage device 714 can store other system orapplication programs and data utilized by the computer 602.

In one embodiment, the storage device 714 or other computer-readablestorage media is encoded with computer-executable instructions which,when loaded into the computer 602, transform the computer from ageneral-purpose computing system into a special-purpose computer capableof implementing the embodiments described herein. Thesecomputer-executable instructions transform the computer 602 byspecifying how the CPUs 704 transition between states, as describedabove. According to one embodiment, the computer 602 has access tocomputer-readable storage media storing computer-executable instructionswhich, when executed by the computer 602, perform the various processesdescribed above with regard to FIGS. 1-5 . The computer 602 can alsoinclude computer-readable storage media having instructions storedthereupon for performing any of the other computer-implementedoperations described herein.

The computer 602 can also include one or more input/output controllers724 for receiving and processing input from a number of input devices,such as a keyboard, a mouse, a touchpad, a touch screen, an electronicstylus, or other type of input device. Similarly, an input/outputcontroller 724 can provide output to a display, such as a computermonitor, a flat-panel display, a digital projector, a printer, or othertype of output device. It will be appreciated that the computer 602might not include all of the components shown in FIG. 7 , can includeother components that are not explicitly shown in FIG. 7 , or mightutilize an architecture completely different than that shown in FIG. 7 .

As described herein, the computer 602 may comprise one or more devices,such as client device 106, server device 104, network resources 106,and/or other devices. The computer 602 may include one or more hardwareprocessors 704 (processors) configured to execute one or more storedinstructions. The processor(s) 704 may comprise one or more cores.Further, the computer 602 may include one or more network interfacesconfigured to provide communications between the computer 602 and otherdevices, such as the communications described herein as being performedby client device 106, network resources 102, and/or other devices. Insome examples, the communications may include data, packet(s),request(s), response(s), and/or other information transfer, forinstance. The network interfaces may include devices configured tocouple to personal area networks (PANs), wired and wireless local areanetworks (LANs), wired and wireless wide area networks (WANs), and soforth. For example, the network interfaces may include devicescompatible with Ethernet, Wi-Fi™, and so forth.

The programs 718 may comprise any type of programs or processes toperform the techniques described in this disclosure in accordance withapplication identification techniques. For instance, the programs 718may cause the computer 602 to perform techniques for communicating withother devices or among elements of a device using any type of protocolor standard usable for determining connectivity. Additionally, theprograms 718 may comprise instructions that cause the computer 602 toperform the specific techniques for application identification.

While the invention is described with respect to the specific examples,it is to be understood that the scope of the invention is not limited tothese specific examples. Since other modifications and changes varied tofit particular operating requirements and environments will be apparentto those skilled in the art, the invention is not considered limited tothe example chosen for purposes of disclosure, and covers all changesand modifications which do not constitute departures from the truespirit and scope of this invention.

Although the application describes embodiments having specificstructural features and/or methodological acts, it is to be understoodthat the claims are not necessarily limited to the specific features oracts described. Rather, the specific features and acts are merelyillustrative some embodiments that fall within the scope of the claimsof the application.

What is claimed is:
 1. A method comprising: receiving, at anauthentication service and from an application on a remote clientdevice, an access request to access a resource managed by theauthentication service, the access request received via a firstcommunication channel between the authentication service and the remoteclient device; in response to the access request, sending a directive tothe application, the directive directing the application to send anidentity request for an identity of the application to an identificationagent on the remote client device; receiving, at the authenticationservice and from the identification agent, the identity of theapplication, wherein the identity is received via a second communicationchannel between the authentication service and the remote client device;based at least in part on the identity of the application, making, bythe authentication service, an access determination regarding whether toallow the application to access to the resource; and sending, to theapplication at the remote client device, a response to the accessrequest, the response based at least in part on the accessdetermination.
 2. The method of claim 1, further comprising: applying apolicy in order to make the access determination, wherein the identityof the application is used by the policy to make the accessdetermination to allow or deny access to the resource by theapplication.
 3. The method of claim 1, further comprising: overwriting,by the authentication service, a previously received identity of theapplication, wherein the previously received identity of the applicationwas received from a user-agent associated with the application.
 4. Themethod of claim 1, wherein the identity of the application includes abrowser identity and a version of a browser used to communicate betweenthe remote client device and the authentication service.
 5. Acomputer-implemented method comprising: receiving, by an identificationagent executing on a client device, an identity request for an identityof an application executing on the client device, the client devicecomprising a plurality of ports, the identity request being sent by theapplication from a first port of the plurality of ports and received bythe identification agent on a second port of the plurality of ports;accessing, by the identification agent, a port list that lists entitiesusing the first port of the plurality of ports; obtaining, by theidentification agent based at least in part on the port list, identityinformation of the application based at least in part on determiningthat the application used the first port for sending the identityrequest; and sending the identity information of the application to anauthentication service on a remote device.
 6. The computer-implementedmethod of claim 5, further comprising: sending, from the application onthe client device and to the authentication service on the remotedevice, an access request for a resource managed by the authenticationservice; and in response to the access request, receiving, by theapplication and from the authentication service, a directive directingthe application to send the identity request for the identityinformation of the application to the identification agent on the clientdevice.
 7. The computer-implemented method of claim 6, wherein theidentity request for the identity information of the application is ahypertext transport protocol (HTTP) request sent from the application tothe identification agent.
 8. The computer-implemented method of claim 5,wherein the port list is a transport control protocol (TCP) connectiontable.
 9. The computer-implemented method of claim 5, furthercomprising: initiating a system call, by the identification agent; andin response to the system call, receiving, by the identification agent,a process identification (PID) of the application.
 10. Thecomputer-implemented method of claim 9, wherein the identity request forthe identity information of the application sent by the identificationagent is based on the PID of the application received in response to thesystem call.
 11. The computer-implemented method of claim 5, wherein theidentity information of the application includes a browser identity of abrowser used to communicate between the application and theauthentication service.
 12. The computer-implemented method of claim 11,wherein the identity information of the application sent to theauthentication service on the remote device includes the browseridentity and a version of the browser.
 13. A client device comprising:at least a first port and a second port; one or more processors; and oneor more non-transitory computer-readable media storingcomputer-executable instructions that, when executed by the one or moreprocessors, cause the one or more processors to: receive, by anidentification agent executing on the client device, an identity requestfor an identity of an application executing on the client device, theidentity request being sent by the application from the first port andreceived by the identification agent on the second port; access, by theidentification agent, a port list that lists entities using the firstport; obtain, by the identification agent based at least in part on theport list, identity information of the application based at least inpart on determining that the application used the first port for sendingthe identity request; and send the identity information of theapplication to an authentication service on a remote device.
 14. Theclient device of claim 13, wherein the computer-executable instructionsfurther cause the one or more processors to: send, from the applicationand to the authentication service on the remote device, an accessrequest for a resource managed by the authentication service; and inresponse to the access request, receive, by the application and from theauthentication service, a directive directing the application to sendthe identity request for the identity of the application to theidentification agent on the client device.
 15. The client device ofclaim 14, wherein the identity request for the identity of theapplication is an Ajax request sent from the application to theidentification agent.
 16. The client device of claim 13, wherein theport list is a transport control protocol (TCP) connection table. 17.The client device of claim 13, wherein the computer-executableinstructions further cause the one or more processors to: initiate asystem call, by the identification agent; and in response to the systemcall, receive, by the identification agent, a process identification(PID) of the application.
 18. The client device of claim 17, wherein theidentity request for the identity information of the application sent bythe identification agent is based on the PID of the application receivedin response to the system call.
 19. The client device of claim 18,wherein the identity information of the application includes a browseridentity of a browser used to communicate between the application andthe authentication service.
 20. The client device of claim 19, whereinthe identity information of the application sent to the authenticationservice on the remote device includes the browser identity and a versionof the browser.